** Update to let subscribers know about new files **

The September 2026 update for the four books in the Microsoft 365 for IT Pros (2027 edition) package are available for subscribers to download. EPUB and PDF files can be downloaded. The paperback edition of the Automating Microsoft 365 with PowerShell eBook has also been updated. August was a busy month with lots happening, most of which ended up in chapter updates. We expect more interesting changes during the coming month.

https://office365itpros.com/2026/09/01/microsoft-365-for-it-pros-135/

A policy can only govern an object the policy engine can resolve. An application appearing in your sign-in logs, does not guarantee that a corresponding service principal exists in your tenant! Why?

That single assumption is where things quietly break.

Microsoft have hundreds of first-party apps in a global directory, but they not all lives in your tenant by default. A service principal is only created on first consent - or when an admin registers it manually, so many background services, infrastructure apps and newer products (Global Secure Access/ZTNA clients, Defender for Mobile, Intune Tunnel, Windows Sign In, AVD and Windows 365…) never trigger that flow for some.

The result: apps your users authenticate against every day, showing up in your sign-in logs - with no service principal to exclude in etc. Conditional Access there use restictions or App Protection policies (my sample in the blog post), simply have nothing to bind to, so the app silently falls outside your controls. "All Apps" policy has more in it than you think, and you can't exclude an app that doesn't exist as an object (like App Protection on the Global Secure Access client in my own usecase in the weekend here).

So I built two scripts to close the gap (can be I change some stuff in the future FYI):

> Find-MissingServicePrincipalsFromSignInLogs.ps1 - this cross-references interactive + non-interactive sign-in logs against your existing SPs and prints a ready-to-paste list of what's missing.
> CreateMissingServicePrincipals.ps1 - registers the missing SPs (with -WhatIf preview first).

A single 24-hour run on a small production tenant (my own 😄) with ~965 existing SPs surfaced dozens of gaps - apps generating sign-ins daily with nothing for policy to resolve against. See it all in the blog post here!

Key takeaways:
> Don’t assume you can exclude everything - if the service principal doesn’t exist, the app is invisible to policy enforcement
> Sign-in logs are your source of truth - if traffic flows, it should have an SP.
> Some AppIDs can't be registered (Microsoft limitation, not your config) - the script flags these as [SKIP].
> This isn't a one-time fix - build periodic discovery into your baseline.

Full write-up, scripts and the Global Secure Access exclusion list here to see more here: https://blog.sonnes.cloud/missing-service-principals-in-entra-id-why-conditional-access-app-protection-and-global-secure-access-will-fail-more-fun/

Have you any expirence with other senarios, where they was missing? 🤔 Let me hear in the comments!

#Microsoft #EntraID #ConditionalAccess #ZeroTrust #AppProtection #GlobalSecureAccess #GSA #Security #Identity #PowerShell #MVP #MVPBuzz #Community #TheBugHunter